What is a policy acknowledgement?

What counts as an acknowledgement

An acknowledgement links a named person to a specific version of a policy and the date they accepted it. A click-through in an HR system, an e-signature or a signed paper form all work, as long as the record can be produced later and shows which version was accepted.

A line in the employment contract saying the employee will follow company policies is weaker evidence. It does not show which policies the person saw or when. Most auditors want an acknowledgement tied to the policy itself, repeated when the policy changes.

What auditors look for

ISO 27001:2022 control 5.1 says information security policies should be communicated to and acknowledged by relevant personnel and relevant interested parties. In a SOC 2 audit, acknowledgements are usually tested as part of the control environment and communication criteria. PCI DSS expects personnel to acknowledge the security policy and procedures at least once every twelve months.

A typical test runs like this. The auditor takes the list of people who joined during the period, picks a sample, and asks for each person’s acknowledgement and the date it was given. Missing or late records show up as exceptions in a SOC 2 report or as nonconformities in an ISO audit.

• Coverage. Everyone in scope has acknowledged, including contractors and people who joined late in the period.
• Timing. New starters acknowledge within a set number of days of joining, and the dates show it.
• Version. The record shows which version was accepted, and a material policy update starts a fresh round.
• Follow-up. Missing acknowledgements are chased, and the chasing is recorded.

Running acknowledgements well

Tie acknowledgements to onboarding, so no one gets access to systems before accepting the core policies, such as information security and acceptable use. Ask for a fresh acknowledgement when a policy changes materially, and once a year from everyone. Many organisations run the yearly round alongside security awareness training, so people see the policy and the training together.

Keep the policy set short enough that people will read it. Asking someone to accept fourteen documents in one sitting gets clicks from people who have read none of them, and an auditor who interviews staff will notice. Write down your own rules for acknowledgement in the policy itself, including the deadline for new starters, and then keep to them.

Related terms

Personnel security

Controls covering people: screening where the law allows it, onboarding and offboarding, training, acceptable-use acknowledgement, and removing access when someone leaves.

Evidence

Any record that shows a control operated: a configuration export, a ticket, a signed policy, an access review. Auditors sample evidence across the period they are reporting on.

Exception (audit)

An instance where a control did not operate as described during the audit period. A SOC 2 report lists exceptions, and readers judge how much they matter.

Nonconformity

An ISO audit finding that a requirement is not met. A minor nonconformity needs a corrective action plan; a major one must be resolved before a certificate is issued.

Access review

A periodic check, usually quarterly, that every user’s access to systems still matches their role, with removals recorded. One of the first pieces of evidence a SOC 2 or ISO 27001 auditor samples.